SAP Security Note
High priority
SAP security note 1682360, “Unauthorized modification of displayed content in CRM_MKTIME”, is a program error note released on 08.05.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
CRM_MKTIMEX_MON can be exploited by an attacker to modify application content, persist unauthorized changes, and potentially obtain authentication information from other legitimate users.
Solution
Implement this SAP Security Note to address the vulnerability.
Reason and prerequisites
The vulnerability in CRM_MKTIMEX_MON leads to a stored cross-site scripting issue. An attacker can permanently alter displayed content on a website, enabling the embedding of malicious content that executes automatically without targeting individual victims. This can result in the theft of another user’s authentication information, allowing the attacker to impersonate the user and access sensitive information with the same permissions. If an administrator is impersonated, the application’s security may be fully compromised.
Full note on SAP: SAP Support Launchpad note 1682360
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].